The Signattio API: envelopes in, sealed evidence out

Everything lives under https://api.signattio.com/api/v1 and speaks JSON; identifiers are ULIDs. Authentication is a bearer key — test_ keys for the sandbox, live_ keys for production, minted in the dashboard, hashed at rest, shown exactly once and revocable instantly. Keep live keys on your server; nothing here belongs in a mobile bundle or a browser.

The core flow is four calls: create the envelope (with an Idempotency-Key header so a retried request cannot double-create), upload the PDF as multipart, add recipients with an identify_level each, and send. The signer then receives a personal link by their channel — email or SMS — and no account is needed on their side.

If the ceremony should happen inside your application rather than over email, create a signing session and open it in your WebView. Sessions are short-lived (about fifteen minutes) and single-use, so a link that leaks is a dead link — the ceremony still runs through the identity check you configured.

Envelope lifecycle events arrive as webhooks signed with HMAC-SHA256, keyed per endpoint, so your backend can react to sent, signed and completed events without polling. The signature lets you verify the event came from Signattio and was not modified on the way.

Plans meter envelopes per month. When the quota is exhausted the API answers 402 with a structured body — including where to upgrade — rather than failing silently mid-flow. The full reference, with client examples in curl and Node, is in the documentation section of this site.